Privacy policy
Who we are
Gulp is made by Astel ([Legal entity name], [Registered address]). We are responsible for the personal information described here. You can reach us at privacy@astelapps.com.
We wrote this policy to be read by people, so it tries to say plainly what we keep and why. The short version is that we collect what Gulp needs to work and to get better, we don't sell your data, and Gulp has no ads.
What we collect
Information you give us
- Account. When you sign in with Apple or Google, we receive an account identifier and, if you choose to share it, your email address. Apple may give us a private relay address instead of your real one.
- Profile. Your display name, your age range (3 to 12, 13 to 17, 18 to 24, or 25 and over), and your mascot's look.
- Your day. Your daily goal, wake-up and bedtime, units, time zone and reminder settings.
- Drink log. Each drink you log: when, the drink type, the size, and whether it counted toward your goal.
- Squads. The squads you start or join, squad names, invite codes, splashes you send and receive, and the activity your squad sees.
- Messages to us. Anything you send when you email us for help.
Information collected as you use Gulp
- Purchases. When you buy Gulp+, a Squad Pass or drops, Apple or Google handle the payment. We receive the product, a transaction identifier, and whether the purchase is active or refunded, through our purchase provider. We never see your card details.
- Drops and items. Your drops balance, a ledger of how each drop was earned or bought, and the Kit items you own.
- Notifications. A push token for your device, so we can tell you when a friend splashes you or your lake fills. Window reminders are scheduled on your phone itself.
- Product analytics. Events about how the app is used (for example, that a gulp was logged or a screen was opened), with your device type, operating system, app version and a pseudonymous identifier. We use PostHog for this, and also for feature flags. [Confirm: PostHog region (US or EU), whether session replay is off, and whether IP addresses are discarded.]
- Crash reports. When the app crashes or hits an error, Sentry receives a technical report: the error and stack trace, device model, operating system and app version. [Confirm: user identifiers attached to crash reports, if any.]
- Contacts, only if you ask. If you tap "Find from contacts" when inviting friends, Gulp asks for access to your contacts. [Confirm: whether contact details leave the phone, and if so, how they are matched (for example, hashed) and how long they are kept.]
[Review: drink logs are hydration records. Check whether they count as consumer health data under laws such as Washington's My Health My Data Act, or as health data under the GDPR, and whether that needs separate consent or a separate notice.]
How we use it
- To run Gulp: count your gulps, keep your rhythm and streak, fill your squad's lake, deliver splashes, and keep your drops and items.
- To send the notifications you've allowed, at most four reminders a day and only during your waking hours.
- To process purchases and check what you're entitled to.
- To keep Gulp fair and safe, for example by spotting implausible logs or misuse of invites.
- To fix bugs and understand which features help people, using analytics and crash reports.
- To answer you when you contact us.
We don't sell your personal information, we don't share it for advertising, and Gulp shows no ads. [Review: legal bases for each use under the GDPR and UK GDPR, such as contract, legitimate interests and consent.]
What your squad sees
People in your squad see your display name, your mascot, today's counted gulps, whether you're on rhythm or soaked, your streak, and the squad's shared activity, such as who splashed whom and when the lake filled. They don't see your drink sizes, your volume or your settings. Anyone with your squad's invite link can ask to join it, so share it with people you know.
Who we share it with
We use a few trusted companies to run Gulp. They process data on our behalf and only for the jobs below.
| Provider | What they do for Gulp |
|---|---|
| Supabase | Database, sign-in, real-time updates and server functions [region] |
| Apple and Google | Sign in, app distribution, payments and push delivery |
| Expo | Push notifications and app updates |
| RevenueCat | Purchase and subscription records |
| PostHog | Product analytics and feature flags |
| Sentry | Crash and error reports |
| Resend | Account and transactional email |
| Cloudflare | This website and invite links |
We may also share information if the law requires it, to protect people's safety, or as part of a merger or sale of the business, in which case this policy would keep applying to your data. [Review: international transfers and the safeguards used, such as Standard Contractual Clauses.]
How long we keep it
We keep your information while your account is open. When you delete your account, we delete or anonymize it within [30] days, and it leaves our backups within [90] days. We keep purchase records for as long as tax and accounting rules require. Analytics and crash data are kept for [period].
Deleting your data
You can delete your account at any time in the app: go to Me and tap Delete account. That removes your account, drink log, mascot, drops, items and squad membership. Splashes and activity you were part of are removed or shown without your name. Subscriptions are billed by Apple or Google, so cancel them in your store account too. If you can't use the app, email privacy@astelapps.com from the address on your account and we'll delete it for you.
Your rights
Depending on where you live, you may have the right to see the data we hold about you, correct it, delete it, take a copy, object to or restrict some uses, and withdraw consent you've given. You can do most of this in the app, and for the rest, email privacy@astelapps.com. You can also complain to your local data protection authority. [Review: specific wording for the GDPR, UK GDPR, CCPA and CPRA, and other US state laws.]
Children
Gulp's onboarding currently offers a 3 to 12 age range. Collecting personal information from children under 13 requires verifiable parental consent under COPPA in the US, and similar consent rules apply to children in the EU and UK (GDPR, often called GDPR-K, and the UK Age Appropriate Design Code). Gulp's social features (squads, invites, splashes) and purchases make this especially important.
The options in the product spec are to block sign-up under 13, to offer a parent-managed kids mode without open invites or purchases, or to build a parental consent flow. This section will describe whichever approach is chosen. Until then, it intentionally states no policy.
This website
gulp.astelapps.com uses no cookies, no analytics and no third-party scripts, and the fonts are served from our own site. Cloudflare, which hosts it, processes basic request information such as IP addresses to deliver pages and protect against abuse.
Changes and contact
If we change this policy in a way that matters, we'll tell you in the app before the change takes effect. Questions are always welcome at privacy@astelapps.com.